CVE-2004-2007: Cross-site scripting (XSS) vulnerability in modules.php in NukeJokes 1.7 and 2 Beta allows remote attackers...

Security readout for executives and security teams

NukeJokes 1.7 and 2 Beta for PhpNuke allowed attacker-controlled content in specific module requests. If exposed, a visitor could be shown malicious script or HTML through the affected joke category or joke view functions. The source bundle does not provide CVSS, a fixed version, or confirmed active exploitation. Exposure is likely limited to legacy PhpNuke sites running the NukeJokes module version 1.7 or 2 Beta. Modern environments are unlikely to be affected unless they still host old PhpNuke code or archived public modules. Treat this as a legacy exposure cleanup item. It is not supported by evidence of active exploitation in the bundle, but any internet-facing obsolete PhpNuke module should be removed or isolated because XSS can affect users and brand trust. Mitigation focus: Inventory public sites for NukeJokes 1.7 or 2 Beta within PhpNuke deployments.; Check vendor or archived advisory guidance; no fixed release is named in the bundle.; Remove, disable, or restrict the module if no supported fix is available..

Prepared

Jun 29, 2026, 21:12 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.